3755 matches found
GHSA-82MP-VP5C-9PF7 ImageMagick: Policy Bypass in concatenate operation due to missing checks
The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy...
CVE-2026-65700
h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The getuserdir function in...
CVE-2026-65895
CVE-2026-65895 affects Grav API Plugin prior to 1.0.10. The issue allows an authenticated user with the api.config.write privilege to modify security-critical plugin configuration scopes, namely rate limiting and CORS. This can disable site-wide rate limiting (facilitating credential brute-forcin...
PT-2026-64094
X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token Summary AuthInjectionMiddleware in meta-ads-mcp rejects HTTP MCP requests only when both auth token and pipeboard token are absent. Because extract token from headers does not recognise the X-Pipeboard-Token header, an attacker who...
CVE-2026-13076
An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and...
CVE-2026-13076
An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and...
UBUNTU-CVE-2026-13076
An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and...
CVE-2026-13062
An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in...
EUVD-2026-47777
An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fat...
CVE-2026-13058 Transaction Command Insufficient Input Validation Leading to Process Termination
An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fat...
CVE-2026-13058
This CVE affects MongoDB’s mongod process. An authenticated user with basic write privileges can send a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, which can trigger a fatal inte...
EUVD-2026-47799
An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in...
CVE-2026-13076
An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and...
CVE-2026-13076
CVE-2026-13076 describes memory-exhaustion in MongoDB’s aggregation framework causing a mongod process termination under memory pressure. An authenticated user with write access and ability to run aggregation queries can trigger disproportionate memory consumption via a specific data type convers...
EUVD-2026-47785
An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and...
Aggregation Framework Memory Exhaustion Leading to Process Termination
An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and...
PT-2026-67364
Impact The Postgres Trigger node interpolated user-supplied identifier parameters channel, function, and trigger names into SQL statements without proper escaping, so an authenticated user could inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential...
PT-2026-63480
Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description An authenticated user with write access and the ability to run aggregation queries can cause a mongod process to be terminated by the operating system. This occurs due to disproportionate...
CVE-2026-60351
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware component: ADF Faces. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper...